From 68a85963c68576ac065cc7037beb0c04ccd38993 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20P=C3=A9ters?= <fpeters@entrouvert.com>
Date: Sun, 21 Feb 2016 17:18:12 +0100
Subject: [PATCH] misc: strip html from field labels when displayed in
 backoffice (#9837)

---
 tests/test_fields.py |  6 ++++++
 wcs/admin/fields.py  |  9 ++++-----
 wcs/admin/forms.py   | 13 ++++++-------
 wcs/fields.py        |  5 +++++
 4 files changed, 21 insertions(+), 12 deletions(-)

diff --git a/tests/test_fields.py b/tests/test_fields.py
index 1f4c18a..018a4cd 100644
--- a/tests/test_fields.py
+++ b/tests/test_fields.py
@@ -1,3 +1,5 @@
+# -*- coding: utf-8 -*-
+
 import shutil
 
 import pytest
@@ -139,6 +141,10 @@ def test_comment():
     form = Form()
     field.add_to_form(form)
     assert '<p>Foobar</p>' in str(form.render())
+    assert field.unhtmled_label == 'Foobar'
+
+    field = fields.CommentField(label='<p>Foobar&eacute;</p>')
+    assert field.unhtmled_label == u'Foobaré'
 
 def test_map():
     assert fields.MapField().get_json_value('42.2;10.2') == {'lat': 42.2, 'lon': 10.2}
diff --git a/wcs/admin/fields.py b/wcs/admin/fields.py
index f65e877..8ef81ae 100644
--- a/wcs/admin/fields.py
+++ b/wcs/admin/fields.py
@@ -42,8 +42,7 @@ class FieldDefPage(Directory):
             raise errors.TraversalError()
         if not self.field.label:
             self.field.label = _('None')
-        self.unhtmled_label = re.sub('<.*?>', ' ', self.field.label)
-        label = misc.ellipsize(self.unhtmled_label, 40)
+        label = misc.ellipsize(self.field.unhtmled_label, 40)
         get_response().breadcrumb.append((field_id + '/', label))
 
     def form(self):
@@ -80,7 +79,7 @@ class FieldDefPage(Directory):
         if redo or not form.get_submit() == 'submit':
             self.html_top('%s - %s' % (_('Form'), self.objectdef.name))
             r = TemplateIO(html=True)
-            r += htmltext('<h2>%s - %s</h2>') % (self.objectdef.name, self.unhtmled_label)
+            r += htmltext('<h2>%s - %s</h2>') % (self.objectdef.name, self.field.unhtmled_label)
             r += form.render()
             return r.getvalue()
         else:
@@ -113,7 +112,7 @@ class FieldDefPage(Directory):
             get_response().breadcrumb.append(('delete', _('Delete')))
             self.html_top(title = _('Delete Field'))
             r = TemplateIO(html=True)
-            r += htmltext('<h2>%s %s</h2>') % (_('Deleting Field:'), self.unhtmled_label)
+            r += htmltext('<h2>%s %s</h2>') % (_('Deleting Field:'), self.field.unhtmled_label)
             r += form.render()
             return r.getvalue()
         else:
@@ -230,7 +229,7 @@ class FieldsDirectory(Directory):
                 except IndexError:
                     type_label = _('Unknown')
                 if field.type in ('subtitle', 'title', 'comment'):
-                    label = misc.ellipsize(field.label, 60)
+                    label = misc.ellipsize(field.unhtmled_label, 60)
                     if field.type in ('subtitle', 'title'):
                         r += htmltext('<strong id="label%s">%s</strong>') % (field.id, label)
                     else:
diff --git a/wcs/admin/forms.py b/wcs/admin/forms.py
index 9019f49..4532043 100644
--- a/wcs/admin/forms.py
+++ b/wcs/admin/forms.py
@@ -939,9 +939,8 @@ class FormDefPage(Directory):
         r += htmltext('<div id="form-diff">')
         r += htmltext('<div>')
         r += htmltext('<table id="table-diff">')
-        def ellipsize_html(label):
-            unhtmled_label = re.sub('<.*?>', ' ', label)
-            return misc.ellipsize(unhtmled_label, 60)
+        def ellipsize_html(field):
+            return misc.ellipsize(field.unhtmled_label, 60)
 
         for diffinfo in difflib.ndiff(current_fields_list, new_fields_list):
             if diffinfo[0] == '?':
@@ -950,8 +949,8 @@ class FormDefPage(Directory):
             field_id = diffinfo[2:].split()[0]
             if diffinfo[0] == ' ':
                 # unchanged line
-                label1 = ellipsize_html(current_fields.get(field_id).label)
-                label2 = ellipsize_html(new_fields.get(field_id).label)
+                label1 = ellipsize_html(current_fields.get(field_id))
+                label2 = ellipsize_html(new_fields.get(field_id))
                 if current_fields.get(field_id) and new_fields.get(field_id) and \
                         current_fields.get(field_id).type != new_fields.get(field_id).type:
                     r += htmltext('<tr class="type-change"><td class="indicator">!</td>')
@@ -964,7 +963,7 @@ class FormDefPage(Directory):
                 r += htmltext('<td>%s</td> <td>%s</td></tr>') % (label1, label2)
             elif diffinfo[0] == '-':
                 # removed field
-                label1 = ellipsize_html(current_fields.get(field_id).label)
+                label1 = ellipsize_html(current_fields.get(field_id))
                 if current_fields.get(field_id) and new_fields.get(field_id) and \
                         current_fields.get(field_id).type != new_fields.get(field_id).type:
                     r += htmltext('<tr class="type-change"><td class="indicator">!</td>')
@@ -973,7 +972,7 @@ class FormDefPage(Directory):
                 r += htmltext('<td>%s</td> <td></td></tr>') % label1
             elif diffinfo[0] == '+':
                 # added field
-                label2 = ellipsize_html(new_fields.get(field_id).label)
+                label2 = ellipsize_html(new_fields.get(field_id))
                 if current_fields.get(field_id) and new_fields.get(field_id) and \
                         current_fields.get(field_id).type != new_fields.get(field_id).type:
                     r += htmltext('<tr class="type-change"><td class="indicator">!</td>')
diff --git a/wcs/fields.py b/wcs/fields.py
index 76b7509..ecd3b45 100644
--- a/wcs/fields.py
+++ b/wcs/fields.py
@@ -21,6 +21,7 @@ import re
 import base64
 import xml.etree.ElementTree as ET
 import collections
+from HTMLParser import HTMLParser
 
 from quixote import get_request, get_publisher
 from quixote.html import htmltext, TemplateIO
@@ -155,6 +156,10 @@ class Field(object):
         pass
     init = classmethod(init)
 
+    @property
+    def unhtmled_label(self):
+        return HTMLParser().unescape(re.sub('<.*?>', ' ', self.label)).strip()
+
     def get_admin_attributes(self):
         return ['label', 'type']
 
-- 
2.7.0